Every project,
fully opened.
Every case file includes source-linked evidence and build notes, with an interactive exhibit where available.
PhantomSection
PhantomSection is a C++ shellcode loader that combines PEB walking, Export Address Table (EAT) parsing, and ETW patching to evade userland API hooking and telemetry. Payloads are staged and XOR-encrypted to bypass static signature analysis.
DropLink
DropLink uses WebRTC for direct browser-to-browser connections and AES-256-GCM end-to-end encryption. No file data ever touches a server. Transfers run entirely between the two participants; the signaling server only coordinates the initial handshake.
Vynlore
A local music player designed for audiophiles who care about playback quality. It decodes all major formats natively in Rust, outputs through WASAPI exclusive mode for bit-perfect delivery, and ships with a 10-band parametric equalizer with genre-aware presets.
ShellPlay
A fully functional browser-based Linux terminal simulator with 100+ commands, a full shell script interpreter, and a virtual filesystem. All state lives in memory only - when you close the browser, everything is wiped clean.
PXE Network Boot Lab
A complete PXE boot implementation: a Linux server providing DHCP and TFTP that boots a legacy PC entirely over the network - bootloader, kernel and initramfs downloaded, no local OS required.
ESP8266 Wake-on-LAN
A wireless remote PC power-on button using a NodeMCU ESP8266, Wake-on-LAN, and a 16x2 I2C LCD display. Press a capacitive touch sensor to wake a desktop computer over the network - about $8–12 in parts.
Cross-Subnet SMB Fix
Root-cause diagnosis of a Wi-Fi extender's NAT mode silently splitting a home network into two subnets, breaking Windows file sharing. Fixed by converting the extender to access-point mode - no Windows changes needed.
ZeroTrust SOC Lab
A laptop-hosted kind cluster lab that runs real Kubernetes privilege paths and a six-hop intrusion chain, then collects audit-log and network-counter telemetry to evaluate Sigma detections and posture checks. The repository documents its coverage gaps and an outstanding failing assertion.